<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br><br>=nat via iPhone</div><div><br>May 25, 2013 1:58$B!"(BMike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> $B$N%a%C%;!<%8(B:<br>
<br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<style><!--
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst, p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle, p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
}
--></style>
<div dir="ltr" style="font-family:Calibri,'Segoe UI',Meiryo,'Microsoft YaHei UI','Microsoft JhengHei UI','Malgun Gothic','Khmer UI','Nirmala UI',Tunga,'Lao UI',Ebrima,sans-serif;font-size:12pt">
<div>You have this deployed now, right? How is this working in your deployment?</div>
<div> </div>
<div>So you’re suggesting that we use the id_token_hint parameter and pass the ID Token to the end_session_endpoint? What do others think of that?</div></div></div></blockquote><div><br></div>+1<div><br><blockquote type="cite">
<div><div dir="ltr" style="font-family:Calibri,'Segoe UI',Meiryo,'Microsoft YaHei UI','Microsoft JhengHei UI','Malgun Gothic','Khmer UI','Nirmala UI',Tunga,'Lao UI',Ebrima,sans-serif;font-size:12pt">
<div> </div>
<div>-- Mike</div>
<div> </div>
<div style="padding-top:5px;border-top-color:rgb(229,229,229);border-top-width:1px;border-top-style:solid">
<div><font face="Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'Khmer UI', 'Nirmala UI', Tunga, 'Lao UI', Ebrima, sans-serif" style="line-height:15pt;letter-spacing:0.02em;font-family:Calibri,"Segoe UI",Meiryo,"Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Khmer UI","Nirmala UI",Tunga,"Lao UI",Ebrima,sans-serif;font-size:11pt"><b>From:</b> Breno
de Medeiros<br>
<b>Sent:</b> Thursday, May 23, 2013 8:23 PM<br>
<b>To:</b> Mike Jones<br>
<b>Cc:</b> Naveen Agarwal, <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a></font></div>
</div>
<div> </div>
I think we should use the same approach as in the immediate flow,<br>
i.e., provide a hint about the intended user. In fact I had suggested<br>
the entire id_token be supplied to the OP.<br>
<br>
On Thu, May 23, 2013 at 6:48 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:<br>
> Hi Breno and Naveen,<br>
><br>
><br>
><br>
> (1) Assume that two users (Alice and Bob) have sessions from the same RP<br>
> logged into to the same OP. Bob decides to log out. Per the session<br>
> management spec, Bob is logged out of the RP locally and then the RP<br>
> redirects to the OP’s end_session_endpoint. Does the OP also log Alice out<br>
> when Bob consents the logout action or just Bob? If Alice is not logged<br>
> out, how does the OP know which user to log out? Through Bob’s cookie? (I<br>
> think that this is the case, but wanted to verify it.)<br>
><br>
><br>
><br>
> At a minimum, we need to say what is expected to happen in this case in the<br>
> spec. It wasn’t clear to some developers reading it recently.<br>
><br>
><br>
><br>
> (2) In a related question, should we be passing an id_token as a parameter<br>
> to the logout URL so that the OP knows which session to log out? Or is this<br>
> already known, per the answer to (1)? Would adding this parameter enable<br>
> additional kinds of attacks?<br>
><br>
><br>
><br>
> Thanks,<br>
><br>
> -- Mike<br>
><br>
><br>
<br>
<br>
<br>
-- <br>
--Breno<br>
</div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Openid-specs-ab mailing list</span><br><span><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a></span><br>
<span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></span><br></div></blockquote></div></body></html>